@webiny/project-aws 0.0.0-unstable.3c5210ad37

package/pulumi/apps/core/configureS3BucketMalwareProtection.js

@@ -0,0 +1,195 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { getAwsAccountId, getAwsRegion } from "../awsUtils.js";
+export const configureS3BucketMalwareProtection = app => {
+  const awsAccountId = getAwsAccountId(app);
+  const awsRegion = getAwsRegion(app);
+  const eventBus = app.resources.eventBus;
+  const bucket = app.resources.fileManagerBucket.output;
+  const currentAccount = {
+    StringEquals: {
+      "aws:ResourceAccount": awsAccountId
+    }
+  };
+  const managedByGuardDuty = {
+    StringEquals: {
+      "events:ManagedBy": "malware-protection-plan.guardduty.amazonaws.com"
+    }
+  };
+  const assumeRole = aws.iam.getPolicyDocument({
+    statements: [{
+      effect: "Allow",
+      principals: [{
+        type: "Service",
+        identifiers: ["malware-protection-plan.guardduty.amazonaws.com"]
+      }],
+      actions: ["sts:AssumeRole"]
+    }]
+  });
+  const role = app.addResource(aws.iam.Role, {
+    name: "fm-bucket-guardduty-role",
+    config: {
+      assumeRolePolicy: assumeRole.then(assumeRole => assumeRole.json)
+    }
+  });
+  const policy = app.addResource(aws.iam.Policy, {
+    name: `fm-bucket-guardduty-role-policy`,
+    config: {
+      description: "This policy enables GuardDuty to interact with the S3 bucket.",
+      policy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Sid: "AllowManagedRuleToSendS3EventsToGuardDuty",
+          Effect: "Allow",
+          Action: ["events:PutRule"],
+          Resource: [pulumi.interpolate`arn:aws:events:${awsRegion}:${awsAccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*`],
+          Condition: {
+            ...managedByGuardDuty,
+            "ForAllValues:StringEquals": {
+              "events:source": "aws.s3",
+              "events:detail-type": ["Object Created", "AWS API Call via CloudTrail"]
+            },
+            Null: {
+              "events:source": "false",
+              "events:detail-type": "false"
+            }
+          }
+        }, {
+          Sid: "AllowUpdateTargetAndDeleteManagedRule",
+          Effect: "Allow",
+          Action: ["events:DeleteRule", "events:PutTargets", "events:RemoveTargets"],
+          Resource: [pulumi.interpolate`arn:aws:events:${awsRegion}:${awsAccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*`],
+          Condition: {
+            ...managedByGuardDuty
+          }
+        }, {
+          Sid: "AllowGuardDutyToMonitorEventBridgeManagedRule",
+          Effect: "Allow",
+          Action: ["events:DescribeRule", "events:ListTargetsByRule"],
+          Resource: [pulumi.interpolate`arn:aws:events:${awsRegion}:${awsAccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*`]
+        }, {
+          Sid: "AllowPostScanTag",
+          Effect: "Allow",
+          Action: ["s3:GetObjectTagging", "s3:GetObjectVersionTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging"],
+          Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}/*`],
+          Condition: {
+            ...currentAccount
+          }
+        }, {
+          Sid: "AllowEnableS3EventBridgeEvents",
+          Effect: "Allow",
+          Action: ["s3:PutBucketNotification", "s3:GetBucketNotification"],
+          Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}`],
+          Condition: {
+            ...currentAccount
+          }
+        }, {
+          Sid: "AllowPutValidationObject",
+          Effect: "Allow",
+          Action: ["s3:PutObject"],
+          Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}/malware-protection-resource-validation-object`],
+          Condition: {
+            ...currentAccount
+          }
+        }, {
+          Sid: "AllowCheckBucketOwnership",
+          Effect: "Allow",
+          Action: ["s3:ListBucket"],
+          Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}`],
+          Condition: {
+            ...currentAccount
+          }
+        }, {
+          Sid: "AllowMalwareScan",
+          Effect: "Allow",
+          Action: ["s3:GetObject", "s3:GetObjectVersion"],
+          Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}/*`],
+          Condition: {
+            ...currentAccount
+          }
+        }]
+      }
+    }
+  });
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `fm-bucket-malware-protection-role-policy-attachment`,
+    config: {
+      role: role.output.name,
+      policyArn: policy.output.arn
+    }
+  });
+  app.addResource(aws.guardduty.MalwareProtectionPlan, {
+    name: `fm-bucket-malware-protection-plan`,
+    config: {
+      role: role.output.arn,
+      protectedResource: {
+        s3Bucket: {
+          bucketName: bucket.bucket
+        }
+      }
+    }
+  });
+
+  // FORWARD EVENTS FROM "DEFAULT" TO CUSTOM EVENT BUS.
+
+  // Create an IAM Role for EventBridge to forward events
+  const eventBridgeRole = app.addResource(aws.iam.Role, {
+    name: "guard-duty-forward-events-role",
+    config: {
+      assumeRolePolicy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+          Effect: "Allow",
+          Principal: {
+            Service: "events.amazonaws.com"
+          },
+          Action: "sts:AssumeRole"
+        }]
+      })
+    }
+  });
+
+  // Attach Policy to Allow EventBridge to PutEvents on Custom Event Bus
+  app.addResource(aws.iam.RolePolicy, {
+    name: "guard-duty-forward-events-policy",
+    config: {
+      role: eventBridgeRole.output,
+      policy: pulumi.output(eventBus.output.arn).apply(arn => JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+          Effect: "Allow",
+          Action: "events:PutEvents",
+          Resource: arn
+        }]
+      }))
+    }
+  });
+  const forwardToCustomBusRule = app.addResource(aws.cloudwatch.EventRule, {
+    name: "forward-events-from-default-to-custom-bus-rule",
+    config: {
+      eventBusName: "default",
+      eventPattern: bucket.bucket.apply(name => JSON.stringify({
+        source: ["aws.guardduty"],
+        "detail-type": ["GuardDuty Malware Protection Object Scan Result"],
+        detail: {
+          s3ObjectDetails: {
+            bucketName: [name]
+          }
+        }
+      }))
+    }
+  });
+
+  // Target: Send events to the custom event bus
+  app.addResource(aws.cloudwatch.EventTarget, {
+    name: "forward-events-from-default-to-custom-bus-target",
+    config: {
+      rule: forwardToCustomBusRule.output.name,
+      roleArn: eventBridgeRole.output.arn,
+      eventBusName: "default",
+      arn: eventBus.output.arn
+    }
+  });
+};
+
+//# sourceMappingURL=configureS3BucketMalwareProtection.js.map

package/pulumi/apps/core/configureS3BucketMalwareProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["pulumi","aws","getAwsAccountId","getAwsRegion","configureS3BucketMalwareProtection","app","awsAccountId","awsRegion","eventBus","resources","bucket","fileManagerBucket","output","currentAccount","StringEquals","managedByGuardDuty","assumeRole","iam","getPolicyDocument","statements","effect","principals","type","identifiers","actions","role","addResource","Role","name","config","assumeRolePolicy","then","json","policy","Policy","description","Version","Statement","Sid","Effect","Action","Resource","interpolate","Condition","Null","RolePolicyAttachment","policyArn","arn","guardduty","MalwareProtectionPlan","protectedResource","s3Bucket","bucketName","eventBridgeRole","JSON","stringify","Principal","Service","RolePolicy","apply","forwardToCustomBusRule","cloudwatch","EventRule","eventBusName","eventPattern","source","detail","s3ObjectDetails","EventTarget","rule","roleArn"],"sources":["configureS3BucketMalwareProtection.ts"],"sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport type { CorePulumiApp } from \"~/pulumi/apps/core/index.js\";\nimport { getAwsAccountId, getAwsRegion } from \"~/pulumi/apps/awsUtils.js\";\n\nexport const configureS3BucketMalwareProtection = (app: CorePulumiApp) => {\n    const awsAccountId = getAwsAccountId(app);\n    const awsRegion = getAwsRegion(app);\n    const eventBus = app.resources.eventBus;\n\n    const bucket = app.resources.fileManagerBucket.output;\n\n    const currentAccount = {\n        StringEquals: {\n            \"aws:ResourceAccount\": awsAccountId\n        }\n    };\n\n    const managedByGuardDuty = {\n        StringEquals: {\n            \"events:ManagedBy\": \"malware-protection-plan.guardduty.amazonaws.com\"\n        }\n    };\n\n    const assumeRole = aws.iam.getPolicyDocument({\n        statements: [\n            {\n                effect: \"Allow\",\n                principals: [\n                    {\n                        type: \"Service\",\n                        identifiers: [\"malware-protection-plan.guardduty.amazonaws.com\"]\n                    }\n                ],\n                actions: [\"sts:AssumeRole\"]\n            }\n        ]\n    });\n\n    const role = app.addResource(aws.iam.Role, {\n        name: \"fm-bucket-guardduty-role\",\n        config: {\n            assumeRolePolicy: assumeRole.then(assumeRole => assumeRole.json)\n        }\n    });\n\n    const policy = app.addResource(aws.iam.Policy, {\n        name: `fm-bucket-guardduty-role-policy`,\n        config: {\n            description: \"This policy enables GuardDuty to interact with the S3 bucket.\",\n            policy: {\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Sid: \"AllowManagedRuleToSendS3EventsToGuardDuty\",\n                        Effect: \"Allow\",\n                        Action: [\"events:PutRule\"],\n                        Resource: [\n                            pulumi.interpolate`arn:aws:events:${awsRegion}:${awsAccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*`\n                        ],\n                        Condition: {\n                            ...managedByGuardDuty,\n                            \"ForAllValues:StringEquals\": {\n                                \"events:source\": \"aws.s3\",\n                                \"events:detail-type\": [\n                                    \"Object Created\",\n                                    \"AWS API Call via CloudTrail\"\n                                ]\n                            },\n                            Null: {\n                                \"events:source\": \"false\",\n                                \"events:detail-type\": \"false\"\n                            }\n                        }\n                    },\n                    {\n                        Sid: \"AllowUpdateTargetAndDeleteManagedRule\",\n                        Effect: \"Allow\",\n                        Action: [\"events:DeleteRule\", \"events:PutTargets\", \"events:RemoveTargets\"],\n                        Resource: [\n                            pulumi.interpolate`arn:aws:events:${awsRegion}:${awsAccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*`\n                        ],\n                        Condition: {\n                            ...managedByGuardDuty\n                        }\n                    },\n                    {\n                        Sid: \"AllowGuardDutyToMonitorEventBridgeManagedRule\",\n                        Effect: \"Allow\",\n                        Action: [\"events:DescribeRule\", \"events:ListTargetsByRule\"],\n                        Resource: [\n                            pulumi.interpolate`arn:aws:events:${awsRegion}:${awsAccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*`\n                        ]\n                    },\n                    {\n                        Sid: \"AllowPostScanTag\",\n                        Effect: \"Allow\",\n                        Action: [\n                            \"s3:GetObjectTagging\",\n                            \"s3:GetObjectVersionTagging\",\n                            \"s3:PutObjectTagging\",\n                            \"s3:PutObjectVersionTagging\"\n                        ],\n                        Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}/*`],\n                        Condition: {\n                            ...currentAccount\n                        }\n                    },\n                    {\n                        Sid: \"AllowEnableS3EventBridgeEvents\",\n                        Effect: \"Allow\",\n                        Action: [\"s3:PutBucketNotification\", \"s3:GetBucketNotification\"],\n                        Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}`],\n                        Condition: {\n                            ...currentAccount\n                        }\n                    },\n                    {\n                        Sid: \"AllowPutValidationObject\",\n                        Effect: \"Allow\",\n                        Action: [\"s3:PutObject\"],\n                        Resource: [\n                            pulumi.interpolate`arn:aws:s3:::${bucket.bucket}/malware-protection-resource-validation-object`\n                        ],\n                        Condition: {\n                            ...currentAccount\n                        }\n                    },\n                    {\n                        Sid: \"AllowCheckBucketOwnership\",\n                        Effect: \"Allow\",\n                        Action: [\"s3:ListBucket\"],\n                        Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}`],\n                        Condition: {\n                            ...currentAccount\n                        }\n                    },\n                    {\n                        Sid: \"AllowMalwareScan\",\n                        Effect: \"Allow\",\n                        Action: [\"s3:GetObject\", \"s3:GetObjectVersion\"],\n                        Resource: [pulumi.interpolate`arn:aws:s3:::${bucket.bucket}/*`],\n                        Condition: {\n                            ...currentAccount\n                        }\n                    }\n                ]\n            }\n        }\n    });\n\n    app.addResource(aws.iam.RolePolicyAttachment, {\n        name: `fm-bucket-malware-protection-role-policy-attachment`,\n        config: {\n            role: role.output.name,\n            policyArn: policy.output.arn\n        }\n    });\n\n    app.addResource(aws.guardduty.MalwareProtectionPlan, {\n        name: `fm-bucket-malware-protection-plan`,\n        config: {\n            role: role.output.arn,\n            protectedResource: {\n                s3Bucket: {\n                    bucketName: bucket.bucket\n                }\n            }\n        }\n    });\n\n    // FORWARD EVENTS FROM \"DEFAULT\" TO CUSTOM EVENT BUS.\n\n    // Create an IAM Role for EventBridge to forward events\n    const eventBridgeRole = app.addResource(aws.iam.Role, {\n        name: \"guard-duty-forward-events-role\",\n        config: {\n            assumeRolePolicy: JSON.stringify({\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Effect: \"Allow\",\n                        Principal: { Service: \"events.amazonaws.com\" },\n                        Action: \"sts:AssumeRole\"\n                    }\n                ]\n            })\n        }\n    });\n\n    // Attach Policy to Allow EventBridge to PutEvents on Custom Event Bus\n    app.addResource(aws.iam.RolePolicy, {\n        name: \"guard-duty-forward-events-policy\",\n        config: {\n            role: eventBridgeRole.output,\n            policy: pulumi.output(eventBus.output.arn).apply(arn =>\n                JSON.stringify({\n                    Version: \"2012-10-17\",\n                    Statement: [\n                        {\n                            Effect: \"Allow\",\n                            Action: \"events:PutEvents\",\n                            Resource: arn\n                        }\n                    ]\n                })\n            )\n        }\n    });\n\n    const forwardToCustomBusRule = app.addResource(aws.cloudwatch.EventRule, {\n        name: \"forward-events-from-default-to-custom-bus-rule\",\n        config: {\n            eventBusName: \"default\",\n            eventPattern: bucket.bucket.apply(name =>\n                JSON.stringify({\n                    source: [\"aws.guardduty\"],\n                    \"detail-type\": [\"GuardDuty Malware Protection Object Scan Result\"],\n                    detail: {\n                        s3ObjectDetails: {\n                            bucketName: [name]\n                        }\n                    }\n                })\n            )\n        }\n    });\n\n    // Target: Send events to the custom event bus\n    app.addResource(aws.cloudwatch.EventTarget, {\n        name: \"forward-events-from-default-to-custom-bus-target\",\n        config: {\n            rule: forwardToCustomBusRule.output.name,\n            roleArn: eventBridgeRole.output.arn,\n            eventBusName: \"default\",\n            arn: eventBus.output.arn\n        }\n    });\n};\n"],"mappings":"AAAA,OAAO,KAAKA,MAAM,MAAM,gBAAgB;AACxC,OAAO,KAAKC,GAAG,MAAM,aAAa;AAElC,SAASC,eAAe,EAAEC,YAAY;AAEtC,OAAO,MAAMC,kCAAkC,GAAIC,GAAkB,IAAK;EACtE,MAAMC,YAAY,GAAGJ,eAAe,CAACG,GAAG,CAAC;EACzC,MAAME,SAAS,GAAGJ,YAAY,CAACE,GAAG,CAAC;EACnC,MAAMG,QAAQ,GAAGH,GAAG,CAACI,SAAS,CAACD,QAAQ;EAEvC,MAAME,MAAM,GAAGL,GAAG,CAACI,SAAS,CAACE,iBAAiB,CAACC,MAAM;EAErD,MAAMC,cAAc,GAAG;IACnBC,YAAY,EAAE;MACV,qBAAqB,EAAER;IAC3B;EACJ,CAAC;EAED,MAAMS,kBAAkB,GAAG;IACvBD,YAAY,EAAE;MACV,kBAAkB,EAAE;IACxB;EACJ,CAAC;EAED,MAAME,UAAU,GAAGf,GAAG,CAACgB,GAAG,CAACC,iBAAiB,CAAC;IACzCC,UAAU,EAAE,CACR;MACIC,MAAM,EAAE,OAAO;MACfC,UAAU,EAAE,CACR;QACIC,IAAI,EAAE,SAAS;QACfC,WAAW,EAAE,CAAC,iDAAiD;MACnE,CAAC,CACJ;MACDC,OAAO,EAAE,CAAC,gBAAgB;IAC9B,CAAC;EAET,CAAC,CAAC;EAEF,MAAMC,IAAI,GAAGpB,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAACgB,GAAG,CAACU,IAAI,EAAE;IACvCC,IAAI,EAAE,0BAA0B;IAChCC,MAAM,EAAE;MACJC,gBAAgB,EAAEd,UAAU,CAACe,IAAI,CAACf,UAAU,IAAIA,UAAU,CAACgB,IAAI;IACnE;EACJ,CAAC,CAAC;EAEF,MAAMC,MAAM,GAAG5B,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAACgB,GAAG,CAACiB,MAAM,EAAE;IAC3CN,IAAI,EAAE,iCAAiC;IACvCC,MAAM,EAAE;MACJM,WAAW,EAAE,+DAA+D;MAC5EF,MAAM,EAAE;QACJG,OAAO,EAAE,YAAY;QACrBC,SAAS,EAAE,CACP;UACIC,GAAG,EAAE,2CAA2C;UAChDC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,gBAAgB,CAAC;UAC1BC,QAAQ,EAAE,CACNzC,MAAM,CAAC0C,WAAW,kBAAkBnC,SAAS,IAAID,YAAY,yDAAyD,CACzH;UACDqC,SAAS,EAAE;YACP,GAAG5B,kBAAkB;YACrB,2BAA2B,EAAE;cACzB,eAAe,EAAE,QAAQ;cACzB,oBAAoB,EAAE,CAClB,gBAAgB,EAChB,6BAA6B;YAErC,CAAC;YACD6B,IAAI,EAAE;cACF,eAAe,EAAE,OAAO;cACxB,oBAAoB,EAAE;YAC1B;UACJ;QACJ,CAAC,EACD;UACIN,GAAG,EAAE,uCAAuC;UAC5CC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;UAC1EC,QAAQ,EAAE,CACNzC,MAAM,CAAC0C,WAAW,kBAAkBnC,SAAS,IAAID,YAAY,yDAAyD,CACzH;UACDqC,SAAS,EAAE;YACP,GAAG5B;UACP;QACJ,CAAC,EACD;UACIuB,GAAG,EAAE,+CAA+C;UACpDC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;UAC3DC,QAAQ,EAAE,CACNzC,MAAM,CAAC0C,WAAW,kBAAkBnC,SAAS,IAAID,YAAY,yDAAyD;QAE9H,CAAC,EACD;UACIgC,GAAG,EAAE,kBAAkB;UACvBC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CACJ,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,CAC/B;UACDC,QAAQ,EAAE,CAACzC,MAAM,CAAC0C,WAAW,gBAAgBhC,MAAM,CAACA,MAAM,IAAI,CAAC;UAC/DiC,SAAS,EAAE;YACP,GAAG9B;UACP;QACJ,CAAC,EACD;UACIyB,GAAG,EAAE,gCAAgC;UACrCC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;UAChEC,QAAQ,EAAE,CAACzC,MAAM,CAAC0C,WAAW,gBAAgBhC,MAAM,CAACA,MAAM,EAAE,CAAC;UAC7DiC,SAAS,EAAE;YACP,GAAG9B;UACP;QACJ,CAAC,EACD;UACIyB,GAAG,EAAE,0BAA0B;UAC/BC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,cAAc,CAAC;UACxBC,QAAQ,EAAE,CACNzC,MAAM,CAAC0C,WAAW,gBAAgBhC,MAAM,CAACA,MAAM,gDAAgD,CAClG;UACDiC,SAAS,EAAE;YACP,GAAG9B;UACP;QACJ,CAAC,EACD;UACIyB,GAAG,EAAE,2BAA2B;UAChCC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,eAAe,CAAC;UACzBC,QAAQ,EAAE,CAACzC,MAAM,CAAC0C,WAAW,gBAAgBhC,MAAM,CAACA,MAAM,EAAE,CAAC;UAC7DiC,SAAS,EAAE;YACP,GAAG9B;UACP;QACJ,CAAC,EACD;UACIyB,GAAG,EAAE,kBAAkB;UACvBC,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,CAAC,cAAc,EAAE,qBAAqB,CAAC;UAC/CC,QAAQ,EAAE,CAACzC,MAAM,CAAC0C,WAAW,gBAAgBhC,MAAM,CAACA,MAAM,IAAI,CAAC;UAC/DiC,SAAS,EAAE;YACP,GAAG9B;UACP;QACJ,CAAC;MAET;IACJ;EACJ,CAAC,CAAC;EAEFR,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAACgB,GAAG,CAAC4B,oBAAoB,EAAE;IAC1CjB,IAAI,EAAE,qDAAqD;IAC3DC,MAAM,EAAE;MACJJ,IAAI,EAAEA,IAAI,CAACb,MAAM,CAACgB,IAAI;MACtBkB,SAAS,EAAEb,MAAM,CAACrB,MAAM,CAACmC;IAC7B;EACJ,CAAC,CAAC;EAEF1C,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAAC+C,SAAS,CAACC,qBAAqB,EAAE;IACjDrB,IAAI,EAAE,mCAAmC;IACzCC,MAAM,EAAE;MACJJ,IAAI,EAAEA,IAAI,CAACb,MAAM,CAACmC,GAAG;MACrBG,iBAAiB,EAAE;QACfC,QAAQ,EAAE;UACNC,UAAU,EAAE1C,MAAM,CAACA;QACvB;MACJ;IACJ;EACJ,CAAC,CAAC;;EAEF;;EAEA;EACA,MAAM2C,eAAe,GAAGhD,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAACgB,GAAG,CAACU,IAAI,EAAE;IAClDC,IAAI,EAAE,gCAAgC;IACtCC,MAAM,EAAE;MACJC,gBAAgB,EAAEwB,IAAI,CAACC,SAAS,CAAC;QAC7BnB,OAAO,EAAE,YAAY;QACrBC,SAAS,EAAE,CACP;UACIE,MAAM,EAAE,OAAO;UACfiB,SAAS,EAAE;YAAEC,OAAO,EAAE;UAAuB,CAAC;UAC9CjB,MAAM,EAAE;QACZ,CAAC;MAET,CAAC;IACL;EACJ,CAAC,CAAC;;EAEF;EACAnC,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAACgB,GAAG,CAACyC,UAAU,EAAE;IAChC9B,IAAI,EAAE,kCAAkC;IACxCC,MAAM,EAAE;MACJJ,IAAI,EAAE4B,eAAe,CAACzC,MAAM;MAC5BqB,MAAM,EAAEjC,MAAM,CAACY,MAAM,CAACJ,QAAQ,CAACI,MAAM,CAACmC,GAAG,CAAC,CAACY,KAAK,CAACZ,GAAG,IAChDO,IAAI,CAACC,SAAS,CAAC;QACXnB,OAAO,EAAE,YAAY;QACrBC,SAAS,EAAE,CACP;UACIE,MAAM,EAAE,OAAO;UACfC,MAAM,EAAE,kBAAkB;UAC1BC,QAAQ,EAAEM;QACd,CAAC;MAET,CAAC,CACL;IACJ;EACJ,CAAC,CAAC;EAEF,MAAMa,sBAAsB,GAAGvD,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAAC4D,UAAU,CAACC,SAAS,EAAE;IACrElC,IAAI,EAAE,gDAAgD;IACtDC,MAAM,EAAE;MACJkC,YAAY,EAAE,SAAS;MACvBC,YAAY,EAAEtD,MAAM,CAACA,MAAM,CAACiD,KAAK,CAAC/B,IAAI,IAClC0B,IAAI,CAACC,SAAS,CAAC;QACXU,MAAM,EAAE,CAAC,eAAe,CAAC;QACzB,aAAa,EAAE,CAAC,iDAAiD,CAAC;QAClEC,MAAM,EAAE;UACJC,eAAe,EAAE;YACbf,UAAU,EAAE,CAACxB,IAAI;UACrB;QACJ;MACJ,CAAC,CACL;IACJ;EACJ,CAAC,CAAC;;EAEF;EACAvB,GAAG,CAACqB,WAAW,CAACzB,GAAG,CAAC4D,UAAU,CAACO,WAAW,EAAE;IACxCxC,IAAI,EAAE,kDAAkD;IACxDC,MAAM,EAAE;MACJwC,IAAI,EAAET,sBAAsB,CAAChD,MAAM,CAACgB,IAAI;MACxC0C,OAAO,EAAEjB,eAAe,CAACzC,MAAM,CAACmC,GAAG;MACnCgB,YAAY,EAAE,SAAS;MACvBhB,GAAG,EAAEvC,QAAQ,CAACI,MAAM,CAACmC;IACzB;EACJ,CAAC,CAAC;AACN,CAAC","ignoreList":[]}

package/pulumi/apps/core/createCorePulumiApp.d.ts

@@ -0,0 +1,32 @@
+import * as aws from "@pulumi/aws";
+export type CorePulumiApp = ReturnType<typeof createCorePulumiApp>;
+export declare function createCorePulumiApp(): import("@webiny/pulumi").PulumiApp<{
+    fileManagerBucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket.js").Bucket>;
+    eventBus: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventBus.js").EventBus>;
+    opensearch: {
+        domain: import("@webiny/pulumi").PulumiAppResource<import("@webiny/pulumi").PulumiAppResourceConstructor<import("@pulumi/aws/opensearch/domain.js").Domain, any>> | import("@webiny/pulumi").PulumiAppRemoteResource<aws.opensearch.GetDomainResult>;
+        domainPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/opensearch/domainPolicy.js").DomainPolicy> | undefined;
+        table: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table.js").Table>;
+        dynamoToElastic: {
+            role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+            policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+            eventSourceMapping: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/eventSourceMapping.js").EventSourceMapping>;
+        };
+    } | undefined;
+    userPool: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito/userPool.js").UserPool>;
+    userPoolClient: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito/userPoolClient.js").UserPoolClient>;
+    dynamoDbTable: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table.js").Table>;
+    logDynamoDbTable: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table.js").Table>;
+    vpc: {
+        vpc: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/vpc.js").Vpc>;
+        subnets: {
+            public: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/subnet.js").Subnet>[];
+            private: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/subnet.js").Subnet>[];
+        };
+        routeTables: {
+            privateSubnets: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/routeTable.js").RouteTable>;
+            publicSubnets: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/routeTable.js").RouteTable>;
+        };
+    } | null;
+}> & import("~/pulumi/utils/withServiceManifest.js").WithServiceManifest;

package/pulumi/apps/core/createCorePulumiApp.js

@@ -0,0 +1,295 @@
+import * as aws from "@pulumi/aws";
+import { createPulumiApp, isResourceOfType } from "@webiny/pulumi";
+import { CoreCognito } from "./CoreCognito.js";
+import { CoreDynamo } from "./CoreDynamo.js";
+import { OpenSearch } from "./CoreOpenSearch.js";
+import { CoreEventBus } from "./CoreEventBus.js";
+import { CoreFileManger } from "./CoreFileManager.js";
+import { CoreVpc } from "./CoreVpc.js";
+import { WatchCommand } from "./WatchCommand.js";
+import { withServiceManifest } from "../../utils/withServiceManifest.js";
+import { addServiceManifestTableItem } from "../../utils/addServiceManifestTableItem.js";
+import * as random from "@pulumi/random";
+import { LogDynamo } from "./LogDynamo.js";
+import { getProjectSdk } from "@webiny/project";
+import { CorePulumi } from "@webiny/project/abstractions/index.js";
+import { getOsConfigFromExtension } from "../extensions/getOsConfigFromExtension.js";
+import { getVpcConfigFromExtension } from "../extensions/getVpcConfigFromExtension.js";
+import { applyAwsResourceTags, getAwsRegion } from "../awsUtils.js";
+import { configureS3BucketMalwareProtection } from "./configureS3BucketMalwareProtection.js";
+import * as pulumi from "@pulumi/pulumi";
+import { CoreAuditLogsDynamo } from "../../index.js";
+export function createCorePulumiApp() {
+  const baseApp = createPulumiApp({
+    name: "core",
+    path: "apps/core",
+    program: async app => {
+      const sdk = await getProjectSdk();
+      const projectConfig = await sdk.getProjectConfig();
+      const pulumiResourceNamePrefix = await sdk.getPulumiResourceNamePrefix();
+      const vpcExtensionsConfig = getVpcConfigFromExtension(projectConfig);
+      const opensearchExtensionConfig = getOsConfigFromExtension(projectConfig);
+      const deploymentId = new random.RandomId("deploymentId", {
+        byteLength: 8
+      });
+      let searchEngineType = null;
+      let searchEngineParams = null;
+      if (opensearchExtensionConfig) {
+        searchEngineParams = opensearchExtensionConfig;
+        searchEngineType = "opensearch";
+      }
+      if (searchEngineParams) {
+        const params = searchEngineParams;
+        if (typeof params === "object") {
+          if (params.domainName) {
+            process.env.AWS_OS_DOMAIN_NAME = params.domainName;
+          }
+          if (params.indexPrefix) {
+            process.env.OPENSEARCH_INDEX_PREFIX = params.indexPrefix;
+          }
+          if (params.sharedIndexes) {
+            process.env.OPENSEARCH_SHARED_INDEXES = "true";
+          }
+        }
+      }
+      if (pulumiResourceNamePrefix) {
+        app.onResource(resource => {
+          if (!resource.name.startsWith(pulumiResourceNamePrefix)) {
+            resource.name = `${pulumiResourceNamePrefix}${resource.name}`;
+          }
+        });
+      }
+
+      // <-------------------- Enterprise start -------------------->
+      app.addHandler(async () => {
+        const usingAdvancedVpcParams = vpcExtensionsConfig && typeof vpcExtensionsConfig !== "boolean";
+        const featureFlags = await sdk.getFeatureFlags();
+        if (featureFlags.isFileManagerThreatDetectionEnabled()) {
+          configureS3BucketMalwareProtection(app);
+        }
+
+        // Not using advanced VPC params? Then immediately exit.
+        if (!usingAdvancedVpcParams) {
+          return;
+        }
+        const {
+          resources,
+          addResource,
+          onResource
+        } = app;
+        const {
+          useExistingVpc,
+          useVpcEndpoints
+        } = vpcExtensionsConfig;
+
+        // 1. We first deal with "existing VPC" setup.
+        if (useExistingVpc) {
+          if ("useVpcEndpoints" in vpcExtensionsConfig) {
+            throw new Error("Cannot specify `useVpcEndpoints` parameter when using an existing VPC. The VPC endpoints configurations should be already defined within the existing VPC.");
+          }
+          if (opensearchExtensionConfig) {
+            if (!useExistingVpc.openSearchDomainVpcConfig) {
+              throw new Error("Cannot specify `useExistingVpc` parameter because the `openSearchDomainVpcConfig` parameter wasn't provided.");
+            }
+            onResource(resource => {
+              if (isResourceOfType(resource, aws.opensearch.Domain)) {
+                resource.config.vpcOptions(useExistingVpc.openSearchDomainVpcConfig);
+              }
+            });
+          }
+          if (!useExistingVpc.lambdaFunctionsVpcConfig) {
+            throw new Error("Cannot specify `useExistingVpc` parameter because the `lambdaFunctionsVpcConfig` parameter wasn't provided.");
+          }
+          onResource(resource => {
+            if (isResourceOfType(resource, aws.lambda.Function)) {
+              const canUseVpc = resource.meta.canUseVpc !== false;
+              if (canUseVpc) {
+                resource.config.vpcConfig(useExistingVpc.lambdaFunctionsVpcConfig);
+              }
+            }
+            if (isResourceOfType(resource, aws.iam.Role)) {
+              if (resource.meta.isLambdaFunctionRole) {
+                addResource(aws.iam.RolePolicyAttachment, {
+                  name: `${resource.name}-vpc-access-execution-role`,
+                  config: {
+                    role: resource.output.name,
+                    policyArn: aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole
+                  }
+                });
+              }
+            }
+          });
+          return;
+        }
+
+        // 2. Now we deal with "non-existing VPC" setup.
+        if (useVpcEndpoints) {
+          const region = getAwsRegion(app);
+          onResource(resource => {
+            if (isResourceOfType(resource, aws.ec2.Vpc)) {
+              resource.config.enableDnsSupport(true);
+              resource.config.enableDnsHostnames(true);
+            }
+          });
+          const {
+            vpc,
+            subnets,
+            routeTables
+          } = resources.vpc;
+          addResource(aws.ec2.VpcEndpoint, {
+            name: "vpc-s3-vpc-endpoint",
+            config: {
+              vpcId: vpc.output.id,
+              serviceName: pulumi.interpolate`com.amazonaws.${region}.s3`,
+              routeTableIds: [routeTables.privateSubnets.output.id]
+            }
+          });
+          addResource(aws.ec2.VpcEndpoint, {
+            name: "vpc-dynamodb-vpc-endpoint",
+            config: {
+              vpcId: vpc.output.id,
+              serviceName: pulumi.interpolate`com.amazonaws.${region}.dynamodb`,
+              routeTableIds: [routeTables.privateSubnets.output.id]
+            }
+          });
+          addResource(aws.ec2.VpcEndpoint, {
+            name: "vpc-sqs-vpc-endpoint",
+            config: {
+              vpcId: vpc.output.id,
+              serviceName: pulumi.interpolate`com.amazonaws.${region}.sqs`,
+              vpcEndpointType: "Interface",
+              privateDnsEnabled: true,
+              securityGroupIds: [vpc.output.defaultSecurityGroupId],
+              subnetIds: subnets.private.map(subNet => subNet.output.id)
+            }
+          });
+          addResource(aws.ec2.VpcEndpoint, {
+            name: "vpc-events-vpc-endpoint",
+            config: {
+              vpcId: vpc.output.id,
+              serviceName: pulumi.interpolate`com.amazonaws.${region}.events`,
+              vpcEndpointType: "Interface",
+              privateDnsEnabled: true,
+              securityGroupIds: [vpc.output.defaultSecurityGroupId],
+              subnetIds: subnets.private.map(subNet => subNet.output.id)
+            }
+          });
+        }
+      });
+      // <-------------------- Enterprise end -------------------->
+
+      // Overrides must be applied via a handler, registered at the very start of the program.
+      // By doing this, we're ensuring user's adjustments are not applied to late.
+      const pulumiHandlers = sdk.getContainer().resolve(CorePulumi);
+      app.addHandler(() => {
+        return pulumiHandlers.execute(app);
+      });
+      const isProduction = app.env.isProduction;
+      const protect = isProduction;
+
+      // Setup DynamoDB table
+      const dynamoDbTable = app.addModule(CoreDynamo, {
+        protect
+      });
+      const logDynamoDbTable = app.addModule(LogDynamo, {
+        protect
+      });
+      const auditLogsDynamoDbTable = app.addModule(CoreAuditLogsDynamo, {
+        protect
+      });
+
+      // Setup VPC
+      const vpcEnabled = vpcExtensionsConfig === true || typeof vpcExtensionsConfig === "object" || isProduction;
+      const vpc = vpcEnabled ? app.addModule(CoreVpc) : null;
+
+      // Setup Cognito
+      const cognito = app.addModule(CoreCognito, {
+        protect,
+        useEmailAsUsername: false
+      });
+
+      // Setup event bus
+      const eventBus = app.addModule(CoreEventBus);
+
+      // Setup file core bucket
+      const {
+        bucket: fileManagerBucket
+      } = app.addModule(CoreFileManger, {
+        protect
+      });
+      let opensearch;
+      if (searchEngineType === "opensearch") {
+        opensearch = app.addModule(OpenSearch, {
+          protect
+        });
+      }
+      app.addModule(WatchCommand, {
+        deploymentId: deploymentId.hex
+      });
+      app.addOutputs({
+        deploymentId: deploymentId.hex,
+        region: aws.config.region,
+        fileManagerBucketId: fileManagerBucket.output.id,
+        primaryDynamodbTableArn: dynamoDbTable.output.arn,
+        primaryDynamodbTableName: dynamoDbTable.output.name,
+        primaryDynamodbTableHashKey: dynamoDbTable.output.hashKey,
+        primaryDynamodbTableRangeKey: dynamoDbTable.output.rangeKey,
+        logDynamodbTableArn: logDynamoDbTable.output.arn,
+        logDynamodbTableName: logDynamoDbTable.output.name,
+        logDynamodbTableHashKey: logDynamoDbTable.output.hashKey,
+        logDynamodbTableRangeKey: logDynamoDbTable.output.rangeKey,
+        auditLogsDynamodbTableArn: auditLogsDynamoDbTable.output.arn,
+        auditLogsDynamodbTableName: auditLogsDynamoDbTable.output.name,
+        auditLogsDynamodbTableHashKey: auditLogsDynamoDbTable.output.hashKey,
+        auditLogsDynamodbTableRangeKey: auditLogsDynamoDbTable.output.rangeKey,
+        cognitoUserPoolId: cognito.userPool.output.id,
+        cognitoUserPoolArn: cognito.userPool.output.arn,
+        cognitoUserPoolPasswordPolicy: cognito.userPool.output.passwordPolicy,
+        cognitoAppClientId: cognito.userPoolClient.output.id,
+        eventBusName: eventBus.output.name,
+        eventBusArn: eventBus.output.arn
+      });
+
+      // Applies internal and user-defined AWS tags.
+      await applyAwsResourceTags("core");
+      return {
+        dynamoDbTable,
+        logDynamoDbTable,
+        vpc,
+        ...cognito,
+        fileManagerBucket,
+        eventBus,
+        opensearch
+      };
+    }
+  });
+  const app = withServiceManifest(baseApp, manifests => {
+    const dynamoTable = baseApp.resources.dynamoDbTable;
+    const table = {
+      tableName: dynamoTable.output.name,
+      hashKey: dynamoTable.output.hashKey,
+      rangeKey: dynamoTable.output.rangeKey
+    };
+    manifests.forEach(manifest => addServiceManifestTableItem(baseApp, table, manifest));
+  });
+  app.addHandler(() => {
+    app.addServiceManifest({
+      name: "core",
+      manifest: {
+        eventBus: {
+          arn: baseApp.resources.eventBus.output.arn,
+          name: baseApp.resources.eventBus.output.name
+        },
+        dynamodbTable: {
+          arn: baseApp.resources.dynamoDbTable.output.arn,
+          name: baseApp.resources.dynamoDbTable.output.name,
+          hashKey: baseApp.resources.dynamoDbTable.output.hashKey,
+          rangeKey: baseApp.resources.dynamoDbTable.output.rangeKey
+        }
+      }
+    });
+  });
+  return app;
+}
+
+//# sourceMappingURL=createCorePulumiApp.js.map

package/pulumi/apps/core/createCorePulumiApp.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createPulumiApp","isResourceOfType","CoreCognito","CoreDynamo","OpenSearch","CoreEventBus","CoreFileManger","CoreVpc","WatchCommand","withServiceManifest","addServiceManifestTableItem","random","LogDynamo","getProjectSdk","CorePulumi","getOsConfigFromExtension","getVpcConfigFromExtension","applyAwsResourceTags","getAwsRegion","configureS3BucketMalwareProtection","pulumi","CoreAuditLogsDynamo","createCorePulumiApp","baseApp","name","path","program","app","sdk","projectConfig","getProjectConfig","pulumiResourceNamePrefix","getPulumiResourceNamePrefix","vpcExtensionsConfig","opensearchExtensionConfig","deploymentId","RandomId","byteLength","searchEngineType","searchEngineParams","params","domainName","process","env","AWS_OS_DOMAIN_NAME","indexPrefix","OPENSEARCH_INDEX_PREFIX","sharedIndexes","OPENSEARCH_SHARED_INDEXES","onResource","resource","startsWith","addHandler","usingAdvancedVpcParams","featureFlags","getFeatureFlags","isFileManagerThreatDetectionEnabled","resources","addResource","useExistingVpc","useVpcEndpoints","Error","openSearchDomainVpcConfig","opensearch","Domain","config","vpcOptions","lambdaFunctionsVpcConfig","lambda","Function","canUseVpc","meta","vpcConfig","iam","Role","isLambdaFunctionRole","RolePolicyAttachment","role","output","policyArn","ManagedPolicy","AWSLambdaVPCAccessExecutionRole","region","ec2","Vpc","enableDnsSupport","enableDnsHostnames","vpc","subnets","routeTables","VpcEndpoint","vpcId","id","serviceName","interpolate","routeTableIds","privateSubnets","vpcEndpointType","privateDnsEnabled","securityGroupIds","defaultSecurityGroupId","subnetIds","private","map","subNet","pulumiHandlers","getContainer","resolve","execute","isProduction","protect","dynamoDbTable","addModule","logDynamoDbTable","auditLogsDynamoDbTable","vpcEnabled","cognito","useEmailAsUsername","eventBus","bucket","fileManagerBucket","hex","addOutputs","fileManagerBucketId","primaryDynamodbTableArn","arn","primaryDynamodbTableName","primaryDynamodbTableHashKey","hashKey","primaryDynamodbTableRangeKey","rangeKey","logDynamodbTableArn","logDynamodbTableName","logDynamodbTableHashKey","logDynamodbTableRangeKey","auditLogsDynamodbTableArn","auditLogsDynamodbTableName","auditLogsDynamodbTableHashKey","auditLogsDynamodbTableRangeKey","cognitoUserPoolId","userPool","cognitoUserPoolArn","cognitoUserPoolPasswordPolicy","passwordPolicy","cognitoAppClientId","userPoolClient","eventBusName","eventBusArn","manifests","dynamoTable","table","tableName","forEach","manifest","addServiceManifest","dynamodbTable"],"sources":["createCorePulumiApp.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createPulumiApp, isResourceOfType } from \"@webiny/pulumi\";\nimport { CoreCognito } from \"./CoreCognito.js\";\nimport { CoreDynamo } from \"./CoreDynamo.js\";\nimport { OpenSearch } from \"./CoreOpenSearch.js\";\nimport { CoreEventBus } from \"./CoreEventBus.js\";\nimport { CoreFileManger } from \"./CoreFileManager.js\";\nimport { CoreVpc } from \"./CoreVpc.js\";\nimport { WatchCommand } from \"./WatchCommand.js\";\nimport { withServiceManifest } from \"~/pulumi/utils/withServiceManifest.js\";\nimport {\n    addServiceManifestTableItem,\n    type TableDefinition\n} from \"~/pulumi/utils/addServiceManifestTableItem.js\";\nimport * as random from \"@pulumi/random\";\nimport { LogDynamo } from \"./LogDynamo.js\";\nimport { getProjectSdk } from \"@webiny/project\";\nimport { CorePulumi } from \"@webiny/project/abstractions/index.js\";\nimport { getOsConfigFromExtension } from \"~/pulumi/apps/extensions/getOsConfigFromExtension.js\";\nimport { getVpcConfigFromExtension } from \"~/pulumi/apps/extensions/getVpcConfigFromExtension.js\";\nimport { applyAwsResourceTags, getAwsRegion } from \"~/pulumi/apps/awsUtils.js\";\nimport { configureS3BucketMalwareProtection } from \"./configureS3BucketMalwareProtection.js\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { CoreAuditLogsDynamo } from \"~/pulumi/index.js\";\n\nexport type CorePulumiApp = ReturnType<typeof createCorePulumiApp>;\n\nexport function createCorePulumiApp() {\n    const baseApp = createPulumiApp({\n        name: \"core\",\n        path: \"apps/core\",\n        program: async app => {\n            const sdk = await getProjectSdk();\n            const projectConfig = await sdk.getProjectConfig();\n\n            const pulumiResourceNamePrefix = await sdk.getPulumiResourceNamePrefix();\n            const vpcExtensionsConfig = getVpcConfigFromExtension(projectConfig);\n            const opensearchExtensionConfig = getOsConfigFromExtension(projectConfig);\n\n            const deploymentId = new random.RandomId(\"deploymentId\", { byteLength: 8 });\n\n            let searchEngineType: \"opensearch\" | null = null;\n            let searchEngineParams: typeof opensearchExtensionConfig | null = null;\n\n            if (opensearchExtensionConfig) {\n                searchEngineParams = opensearchExtensionConfig;\n                searchEngineType = \"opensearch\";\n            }\n\n            if (searchEngineParams) {\n                const params = searchEngineParams;\n                if (typeof params === \"object\") {\n                    if (params.domainName) {\n                        process.env.AWS_OS_DOMAIN_NAME = params.domainName;\n                    }\n\n                    if (params.indexPrefix) {\n                        process.env.OPENSEARCH_INDEX_PREFIX = params.indexPrefix;\n                    }\n\n                    if (params.sharedIndexes) {\n                        process.env.OPENSEARCH_SHARED_INDEXES = \"true\";\n                    }\n                }\n            }\n\n            if (pulumiResourceNamePrefix) {\n                app.onResource(resource => {\n                    if (!resource.name.startsWith(pulumiResourceNamePrefix)) {\n                        resource.name = `${pulumiResourceNamePrefix}${resource.name}`;\n                    }\n                });\n            }\n\n            // <-------------------- Enterprise start -------------------->\n            app.addHandler(async () => {\n                const usingAdvancedVpcParams =\n                    vpcExtensionsConfig && typeof vpcExtensionsConfig !== \"boolean\";\n\n                const featureFlags = await sdk.getFeatureFlags();\n                if (featureFlags.isFileManagerThreatDetectionEnabled()) {\n                    configureS3BucketMalwareProtection(app as CorePulumiApp);\n                }\n\n                // Not using advanced VPC params? Then immediately exit.\n                if (!usingAdvancedVpcParams) {\n                    return;\n                }\n\n                const { resources, addResource, onResource } = app as CorePulumiApp;\n                const { useExistingVpc, useVpcEndpoints } = vpcExtensionsConfig;\n\n                // 1. We first deal with \"existing VPC\" setup.\n                if (useExistingVpc) {\n                    if (\"useVpcEndpoints\" in vpcExtensionsConfig) {\n                        throw new Error(\n                            \"Cannot specify `useVpcEndpoints` parameter when using an existing VPC. The VPC endpoints configurations should be already defined within the existing VPC.\"\n                        );\n                    }\n\n                    if (opensearchExtensionConfig) {\n                        if (!useExistingVpc.openSearchDomainVpcConfig) {\n                            throw new Error(\n                                \"Cannot specify `useExistingVpc` parameter because the `openSearchDomainVpcConfig` parameter wasn't provided.\"\n                            );\n                        }\n\n                        onResource(resource => {\n                            if (isResourceOfType(resource, aws.opensearch.Domain)) {\n                                resource.config.vpcOptions(\n                                    useExistingVpc!.openSearchDomainVpcConfig\n                                );\n                            }\n                        });\n                    }\n\n                    if (!useExistingVpc.lambdaFunctionsVpcConfig) {\n                        throw new Error(\n                            \"Cannot specify `useExistingVpc` parameter because the `lambdaFunctionsVpcConfig` parameter wasn't provided.\"\n                        );\n                    }\n\n                    onResource(resource => {\n                        if (isResourceOfType(resource, aws.lambda.Function)) {\n                            const canUseVpc = resource.meta.canUseVpc !== false;\n                            if (canUseVpc) {\n                                resource.config.vpcConfig(useExistingVpc!.lambdaFunctionsVpcConfig);\n                            }\n                        }\n\n                        if (isResourceOfType(resource, aws.iam.Role)) {\n                            if (resource.meta.isLambdaFunctionRole) {\n                                addResource(aws.iam.RolePolicyAttachment, {\n                                    name: `${resource.name}-vpc-access-execution-role`,\n                                    config: {\n                                        role: resource.output.name,\n                                        policyArn:\n                                            aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole\n                                    }\n                                });\n                            }\n                        }\n                    });\n\n                    return;\n                }\n\n                // 2. Now we deal with \"non-existing VPC\" setup.\n                if (useVpcEndpoints) {\n                    const region = getAwsRegion(app);\n\n                    onResource(resource => {\n                        if (isResourceOfType(resource, aws.ec2.Vpc)) {\n                            resource.config.enableDnsSupport(true);\n                            resource.config.enableDnsHostnames(true);\n                        }\n                    });\n\n                    const { vpc, subnets, routeTables } = resources.vpc!;\n                    addResource(aws.ec2.VpcEndpoint, {\n                        name: \"vpc-s3-vpc-endpoint\",\n                        config: {\n                            vpcId: vpc.output.id,\n                            serviceName: pulumi.interpolate`com.amazonaws.${region}.s3`,\n                            routeTableIds: [routeTables.privateSubnets.output.id]\n                        }\n                    });\n\n                    addResource(aws.ec2.VpcEndpoint, {\n                        name: \"vpc-dynamodb-vpc-endpoint\",\n                        config: {\n                            vpcId: vpc.output.id,\n                            serviceName: pulumi.interpolate`com.amazonaws.${region}.dynamodb`,\n                            routeTableIds: [routeTables.privateSubnets.output.id]\n                        }\n                    });\n\n                    addResource(aws.ec2.VpcEndpoint, {\n                        name: \"vpc-sqs-vpc-endpoint\",\n                        config: {\n                            vpcId: vpc.output.id,\n                            serviceName: pulumi.interpolate`com.amazonaws.${region}.sqs`,\n                            vpcEndpointType: \"Interface\",\n                            privateDnsEnabled: true,\n                            securityGroupIds: [vpc.output.defaultSecurityGroupId],\n                            subnetIds: subnets.private.map(subNet => subNet.output.id)\n                        }\n                    });\n\n                    addResource(aws.ec2.VpcEndpoint, {\n                        name: \"vpc-events-vpc-endpoint\",\n                        config: {\n                            vpcId: vpc.output.id,\n                            serviceName: pulumi.interpolate`com.amazonaws.${region}.events`,\n                            vpcEndpointType: \"Interface\",\n                            privateDnsEnabled: true,\n                            securityGroupIds: [vpc.output.defaultSecurityGroupId],\n                            subnetIds: subnets.private.map(subNet => subNet.output.id)\n                        }\n                    });\n                }\n            });\n            // <-------------------- Enterprise end -------------------->\n\n            // Overrides must be applied via a handler, registered at the very start of the program.\n            // By doing this, we're ensuring user's adjustments are not applied to late.\n            const pulumiHandlers = sdk.getContainer().resolve(CorePulumi);\n\n            app.addHandler(() => {\n                return pulumiHandlers.execute(app as unknown as CorePulumiApp);\n            });\n\n            const isProduction = app.env.isProduction;\n            const protect = isProduction;\n\n            // Setup DynamoDB table\n            const dynamoDbTable = app.addModule(CoreDynamo, { protect });\n            const logDynamoDbTable = app.addModule(LogDynamo, { protect });\n            const auditLogsDynamoDbTable = app.addModule(CoreAuditLogsDynamo, { protect });\n\n            // Setup VPC\n            const vpcEnabled =\n                vpcExtensionsConfig === true ||\n                typeof vpcExtensionsConfig === \"object\" ||\n                isProduction;\n\n            const vpc = vpcEnabled ? app.addModule(CoreVpc) : null;\n\n            // Setup Cognito\n            const cognito = app.addModule(CoreCognito, {\n                protect,\n                useEmailAsUsername: false\n            });\n\n            // Setup event bus\n            const eventBus = app.addModule(CoreEventBus);\n\n            // Setup file core bucket\n            const { bucket: fileManagerBucket } = app.addModule(CoreFileManger, { protect });\n\n            let opensearch;\n            if (searchEngineType === \"opensearch\") {\n                opensearch = app.addModule(OpenSearch, { protect });\n            }\n\n            app.addModule(WatchCommand, { deploymentId: deploymentId.hex });\n\n            app.addOutputs({\n                deploymentId: deploymentId.hex,\n                region: aws.config.region,\n                fileManagerBucketId: fileManagerBucket.output.id,\n                primaryDynamodbTableArn: dynamoDbTable.output.arn,\n                primaryDynamodbTableName: dynamoDbTable.output.name,\n                primaryDynamodbTableHashKey: dynamoDbTable.output.hashKey,\n                primaryDynamodbTableRangeKey: dynamoDbTable.output.rangeKey,\n                logDynamodbTableArn: logDynamoDbTable.output.arn,\n                logDynamodbTableName: logDynamoDbTable.output.name,\n                logDynamodbTableHashKey: logDynamoDbTable.output.hashKey,\n                logDynamodbTableRangeKey: logDynamoDbTable.output.rangeKey,\n                auditLogsDynamodbTableArn: auditLogsDynamoDbTable.output.arn,\n                auditLogsDynamodbTableName: auditLogsDynamoDbTable.output.name,\n                auditLogsDynamodbTableHashKey: auditLogsDynamoDbTable.output.hashKey,\n                auditLogsDynamodbTableRangeKey: auditLogsDynamoDbTable.output.rangeKey,\n                cognitoUserPoolId: cognito.userPool.output.id,\n                cognitoUserPoolArn: cognito.userPool.output.arn,\n                cognitoUserPoolPasswordPolicy: cognito.userPool.output.passwordPolicy,\n                cognitoAppClientId: cognito.userPoolClient.output.id,\n                eventBusName: eventBus.output.name,\n                eventBusArn: eventBus.output.arn\n            });\n\n            // Applies internal and user-defined AWS tags.\n            await applyAwsResourceTags(\"core\");\n\n            return {\n                dynamoDbTable,\n                logDynamoDbTable,\n                vpc,\n                ...cognito,\n                fileManagerBucket,\n                eventBus,\n                opensearch\n            };\n        }\n    });\n\n    const app = withServiceManifest(baseApp, manifests => {\n        const dynamoTable = baseApp.resources.dynamoDbTable;\n\n        const table: TableDefinition = {\n            tableName: dynamoTable.output.name,\n            hashKey: dynamoTable.output.hashKey,\n            rangeKey: dynamoTable.output.rangeKey\n        };\n\n        manifests.forEach(manifest => addServiceManifestTableItem(baseApp, table, manifest));\n    });\n\n    app.addHandler(() => {\n        app.addServiceManifest({\n            name: \"core\",\n            manifest: {\n                eventBus: {\n                    arn: baseApp.resources.eventBus.output.arn,\n                    name: baseApp.resources.eventBus.output.name\n                },\n                dynamodbTable: {\n                    arn: baseApp.resources.dynamoDbTable.output.arn,\n                    name: baseApp.resources.dynamoDbTable.output.name,\n                    hashKey: baseApp.resources.dynamoDbTable.output.hashKey,\n                    rangeKey: baseApp.resources.dynamoDbTable.output.rangeKey\n                }\n            }\n        });\n    });\n\n    return app;\n}\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,EAAEC,gBAAgB,QAAQ,gBAAgB;AAClE,SAASC,WAAW;AACpB,SAASC,UAAU;AACnB,SAASC,UAAU;AACnB,SAASC,YAAY;AACrB,SAASC,cAAc;AACvB,SAASC,OAAO;AAChB,SAASC,YAAY;AACrB,SAASC,mBAAmB;AAC5B,SACIC,2BAA2B;AAG/B,OAAO,KAAKC,MAAM,MAAM,gBAAgB;AACxC,SAASC,SAAS;AAClB,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,SAASC,UAAU,QAAQ,uCAAuC;AAClE,SAASC,wBAAwB;AACjC,SAASC,yBAAyB;AAClC,SAASC,oBAAoB,EAAEC,YAAY;AAC3C,SAASC,kCAAkC;AAC3C,OAAO,KAAKC,MAAM,MAAM,gBAAgB;AACxC,SAASC,mBAAmB;AAI5B,OAAO,SAASC,mBAAmBA,CAAA,EAAG;EAClC,MAAMC,OAAO,GAAGvB,eAAe,CAAC;IAC5BwB,IAAI,EAAE,MAAM;IACZC,IAAI,EAAE,WAAW;IACjBC,OAAO,EAAE,MAAMC,GAAG,IAAI;MAClB,MAAMC,GAAG,GAAG,MAAMf,aAAa,CAAC,CAAC;MACjC,MAAMgB,aAAa,GAAG,MAAMD,GAAG,CAACE,gBAAgB,CAAC,CAAC;MAElD,MAAMC,wBAAwB,GAAG,MAAMH,GAAG,CAACI,2BAA2B,CAAC,CAAC;MACxE,MAAMC,mBAAmB,GAAGjB,yBAAyB,CAACa,aAAa,CAAC;MACpE,MAAMK,yBAAyB,GAAGnB,wBAAwB,CAACc,aAAa,CAAC;MAEzE,MAAMM,YAAY,GAAG,IAAIxB,MAAM,CAACyB,QAAQ,CAAC,cAAc,EAAE;QAAEC,UAAU,EAAE;MAAE,CAAC,CAAC;MAE3E,IAAIC,gBAAqC,GAAG,IAAI;MAChD,IAAIC,kBAA2D,GAAG,IAAI;MAEtE,IAAIL,yBAAyB,EAAE;QAC3BK,kBAAkB,GAAGL,yBAAyB;QAC9CI,gBAAgB,GAAG,YAAY;MACnC;MAEA,IAAIC,kBAAkB,EAAE;QACpB,MAAMC,MAAM,GAAGD,kBAAkB;QACjC,IAAI,OAAOC,MAAM,KAAK,QAAQ,EAAE;UAC5B,IAAIA,MAAM,CAACC,UAAU,EAAE;YACnBC,OAAO,CAACC,GAAG,CAACC,kBAAkB,GAAGJ,MAAM,CAACC,UAAU;UACtD;UAEA,IAAID,MAAM,CAACK,WAAW,EAAE;YACpBH,OAAO,CAACC,GAAG,CAACG,uBAAuB,GAAGN,MAAM,CAACK,WAAW;UAC5D;UAEA,IAAIL,MAAM,CAACO,aAAa,EAAE;YACtBL,OAAO,CAACC,GAAG,CAACK,yBAAyB,GAAG,MAAM;UAClD;QACJ;MACJ;MAEA,IAAIjB,wBAAwB,EAAE;QAC1BJ,GAAG,CAACsB,UAAU,CAACC,QAAQ,IAAI;UACvB,IAAI,CAACA,QAAQ,CAAC1B,IAAI,CAAC2B,UAAU,CAACpB,wBAAwB,CAAC,EAAE;YACrDmB,QAAQ,CAAC1B,IAAI,GAAG,GAAGO,wBAAwB,GAAGmB,QAAQ,CAAC1B,IAAI,EAAE;UACjE;QACJ,CAAC,CAAC;MACN;;MAEA;MACAG,GAAG,CAACyB,UAAU,CAAC,YAAY;QACvB,MAAMC,sBAAsB,GACxBpB,mBAAmB,IAAI,OAAOA,mBAAmB,KAAK,SAAS;QAEnE,MAAMqB,YAAY,GAAG,MAAM1B,GAAG,CAAC2B,eAAe,CAAC,CAAC;QAChD,IAAID,YAAY,CAACE,mCAAmC,CAAC,CAAC,EAAE;UACpDrC,kCAAkC,CAACQ,GAAoB,CAAC;QAC5D;;QAEA;QACA,IAAI,CAAC0B,sBAAsB,EAAE;UACzB;QACJ;QAEA,MAAM;UAAEI,SAAS;UAAEC,WAAW;UAAET;QAAW,CAAC,GAAGtB,GAAoB;QACnE,MAAM;UAAEgC,cAAc;UAAEC;QAAgB,CAAC,GAAG3B,mBAAmB;;QAE/D;QACA,IAAI0B,cAAc,EAAE;UAChB,IAAI,iBAAiB,IAAI1B,mBAAmB,EAAE;YAC1C,MAAM,IAAI4B,KAAK,CACX,4JACJ,CAAC;UACL;UAEA,IAAI3B,yBAAyB,EAAE;YAC3B,IAAI,CAACyB,cAAc,CAACG,yBAAyB,EAAE;cAC3C,MAAM,IAAID,KAAK,CACX,8GACJ,CAAC;YACL;YAEAZ,UAAU,CAACC,QAAQ,IAAI;cACnB,IAAIjD,gBAAgB,CAACiD,QAAQ,EAAEnD,GAAG,CAACgE,UAAU,CAACC,MAAM,CAAC,EAAE;gBACnDd,QAAQ,CAACe,MAAM,CAACC,UAAU,CACtBP,cAAc,CAAEG,yBACpB,CAAC;cACL;YACJ,CAAC,CAAC;UACN;UAEA,IAAI,CAACH,cAAc,CAACQ,wBAAwB,EAAE;YAC1C,MAAM,IAAIN,KAAK,CACX,6GACJ,CAAC;UACL;UAEAZ,UAAU,CAACC,QAAQ,IAAI;YACnB,IAAIjD,gBAAgB,CAACiD,QAAQ,EAAEnD,GAAG,CAACqE,MAAM,CAACC,QAAQ,CAAC,EAAE;cACjD,MAAMC,SAAS,GAAGpB,QAAQ,CAACqB,IAAI,CAACD,SAAS,KAAK,KAAK;cACnD,IAAIA,SAAS,EAAE;gBACXpB,QAAQ,CAACe,MAAM,CAACO,SAAS,CAACb,cAAc,CAAEQ,wBAAwB,CAAC;cACvE;YACJ;YAEA,IAAIlE,gBAAgB,CAACiD,QAAQ,EAAEnD,GAAG,CAAC0E,GAAG,CAACC,IAAI,CAAC,EAAE;cAC1C,IAAIxB,QAAQ,CAACqB,IAAI,CAACI,oBAAoB,EAAE;gBACpCjB,WAAW,CAAC3D,GAAG,CAAC0E,GAAG,CAACG,oBAAoB,EAAE;kBACtCpD,IAAI,EAAE,GAAG0B,QAAQ,CAAC1B,IAAI,4BAA4B;kBAClDyC,MAAM,EAAE;oBACJY,IAAI,EAAE3B,QAAQ,CAAC4B,MAAM,CAACtD,IAAI;oBAC1BuD,SAAS,EACLhF,GAAG,CAAC0E,GAAG,CAACO,aAAa,CAACC;kBAC9B;gBACJ,CAAC,CAAC;cACN;YACJ;UACJ,CAAC,CAAC;UAEF;QACJ;;QAEA;QACA,IAAIrB,eAAe,EAAE;UACjB,MAAMsB,MAAM,GAAGhE,YAAY,CAACS,GAAG,CAAC;UAEhCsB,UAAU,CAACC,QAAQ,IAAI;YACnB,IAAIjD,gBAAgB,CAACiD,QAAQ,EAAEnD,GAAG,CAACoF,GAAG,CAACC,GAAG,CAAC,EAAE;cACzClC,QAAQ,CAACe,MAAM,CAACoB,gBAAgB,CAAC,IAAI,CAAC;cACtCnC,QAAQ,CAACe,MAAM,CAACqB,kBAAkB,CAAC,IAAI,CAAC;YAC5C;UACJ,CAAC,CAAC;UAEF,MAAM;YAAEC,GAAG;YAAEC,OAAO;YAAEC;UAAY,CAAC,GAAGhC,SAAS,CAAC8B,GAAI;UACpD7B,WAAW,CAAC3D,GAAG,CAACoF,GAAG,CAACO,WAAW,EAAE;YAC7BlE,IAAI,EAAE,qBAAqB;YAC3ByC,MAAM,EAAE;cACJ0B,KAAK,EAAEJ,GAAG,CAACT,MAAM,CAACc,EAAE;cACpBC,WAAW,EAAEzE,MAAM,CAAC0E,WAAW,iBAAiBZ,MAAM,KAAK;cAC3Da,aAAa,EAAE,CAACN,WAAW,CAACO,cAAc,CAAClB,MAAM,CAACc,EAAE;YACxD;UACJ,CAAC,CAAC;UAEFlC,WAAW,CAAC3D,GAAG,CAACoF,GAAG,CAACO,WAAW,EAAE;YAC7BlE,IAAI,EAAE,2BAA2B;YACjCyC,MAAM,EAAE;cACJ0B,KAAK,EAAEJ,GAAG,CAACT,MAAM,CAACc,EAAE;cACpBC,WAAW,EAAEzE,MAAM,CAAC0E,WAAW,iBAAiBZ,MAAM,WAAW;cACjEa,aAAa,EAAE,CAACN,WAAW,CAACO,cAAc,CAAClB,MAAM,CAACc,EAAE;YACxD;UACJ,CAAC,CAAC;UAEFlC,WAAW,CAAC3D,GAAG,CAACoF,GAAG,CAACO,WAAW,EAAE;YAC7BlE,IAAI,EAAE,sBAAsB;YAC5ByC,MAAM,EAAE;cACJ0B,KAAK,EAAEJ,GAAG,CAACT,MAAM,CAACc,EAAE;cACpBC,WAAW,EAAEzE,MAAM,CAAC0E,WAAW,iBAAiBZ,MAAM,MAAM;cAC5De,eAAe,EAAE,WAAW;cAC5BC,iBAAiB,EAAE,IAAI;cACvBC,gBAAgB,EAAE,CAACZ,GAAG,CAACT,MAAM,CAACsB,sBAAsB,CAAC;cACrDC,SAAS,EAAEb,OAAO,CAACc,OAAO,CAACC,GAAG,CAACC,MAAM,IAAIA,MAAM,CAAC1B,MAAM,CAACc,EAAE;YAC7D;UACJ,CAAC,CAAC;UAEFlC,WAAW,CAAC3D,GAAG,CAACoF,GAAG,CAACO,WAAW,EAAE;YAC7BlE,IAAI,EAAE,yBAAyB;YAC/ByC,MAAM,EAAE;cACJ0B,KAAK,EAAEJ,GAAG,CAACT,MAAM,CAACc,EAAE;cACpBC,WAAW,EAAEzE,MAAM,CAAC0E,WAAW,iBAAiBZ,MAAM,SAAS;cAC/De,eAAe,EAAE,WAAW;cAC5BC,iBAAiB,EAAE,IAAI;cACvBC,gBAAgB,EAAE,CAACZ,GAAG,CAACT,MAAM,CAACsB,sBAAsB,CAAC;cACrDC,SAAS,EAAEb,OAAO,CAACc,OAAO,CAACC,GAAG,CAACC,MAAM,IAAIA,MAAM,CAAC1B,MAAM,CAACc,EAAE;YAC7D;UACJ,CAAC,CAAC;QACN;MACJ,CAAC,CAAC;MACF;;MAEA;MACA;MACA,MAAMa,cAAc,GAAG7E,GAAG,CAAC8E,YAAY,CAAC,CAAC,CAACC,OAAO,CAAC7F,UAAU,CAAC;MAE7Da,GAAG,CAACyB,UAAU,CAAC,MAAM;QACjB,OAAOqD,cAAc,CAACG,OAAO,CAACjF,GAA+B,CAAC;MAClE,CAAC,CAAC;MAEF,MAAMkF,YAAY,GAAGlF,GAAG,CAACgB,GAAG,CAACkE,YAAY;MACzC,MAAMC,OAAO,GAAGD,YAAY;;MAE5B;MACA,MAAME,aAAa,GAAGpF,GAAG,CAACqF,SAAS,CAAC7G,UAAU,EAAE;QAAE2G;MAAQ,CAAC,CAAC;MAC5D,MAAMG,gBAAgB,GAAGtF,GAAG,CAACqF,SAAS,CAACpG,SAAS,EAAE;QAAEkG;MAAQ,CAAC,CAAC;MAC9D,MAAMI,sBAAsB,GAAGvF,GAAG,CAACqF,SAAS,CAAC3F,mBAAmB,EAAE;QAAEyF;MAAQ,CAAC,CAAC;;MAE9E;MACA,MAAMK,UAAU,GACZlF,mBAAmB,KAAK,IAAI,IAC5B,OAAOA,mBAAmB,KAAK,QAAQ,IACvC4E,YAAY;MAEhB,MAAMtB,GAAG,GAAG4B,UAAU,GAAGxF,GAAG,CAACqF,SAAS,CAACzG,OAAO,CAAC,GAAG,IAAI;;MAEtD;MACA,MAAM6G,OAAO,GAAGzF,GAAG,CAACqF,SAAS,CAAC9G,WAAW,EAAE;QACvC4G,OAAO;QACPO,kBAAkB,EAAE;MACxB,CAAC,CAAC;;MAEF;MACA,MAAMC,QAAQ,GAAG3F,GAAG,CAACqF,SAAS,CAAC3G,YAAY,CAAC;;MAE5C;MACA,MAAM;QAAEkH,MAAM,EAAEC;MAAkB,CAAC,GAAG7F,GAAG,CAACqF,SAAS,CAAC1G,cAAc,EAAE;QAAEwG;MAAQ,CAAC,CAAC;MAEhF,IAAI/C,UAAU;MACd,IAAIzB,gBAAgB,KAAK,YAAY,EAAE;QACnCyB,UAAU,GAAGpC,GAAG,CAACqF,SAAS,CAAC5G,UAAU,EAAE;UAAE0G;QAAQ,CAAC,CAAC;MACvD;MAEAnF,GAAG,CAACqF,SAAS,CAACxG,YAAY,EAAE;QAAE2B,YAAY,EAAEA,YAAY,CAACsF;MAAI,CAAC,CAAC;MAE/D9F,GAAG,CAAC+F,UAAU,CAAC;QACXvF,YAAY,EAAEA,YAAY,CAACsF,GAAG;QAC9BvC,MAAM,EAAEnF,GAAG,CAACkE,MAAM,CAACiB,MAAM;QACzByC,mBAAmB,EAAEH,iBAAiB,CAAC1C,MAAM,CAACc,EAAE;QAChDgC,uBAAuB,EAAEb,aAAa,CAACjC,MAAM,CAAC+C,GAAG;QACjDC,wBAAwB,EAAEf,aAAa,CAACjC,MAAM,CAACtD,IAAI;QACnDuG,2BAA2B,EAAEhB,aAAa,CAACjC,MAAM,CAACkD,OAAO;QACzDC,4BAA4B,EAAElB,aAAa,CAACjC,MAAM,CAACoD,QAAQ;QAC3DC,mBAAmB,EAAElB,gBAAgB,CAACnC,MAAM,CAAC+C,GAAG;QAChDO,oBAAoB,EAAEnB,gBAAgB,CAACnC,MAAM,CAACtD,IAAI;QAClD6G,uBAAuB,EAAEpB,gBAAgB,CAACnC,MAAM,CAACkD,OAAO;QACxDM,wBAAwB,EAAErB,gBAAgB,CAACnC,MAAM,CAACoD,QAAQ;QAC1DK,yBAAyB,EAAErB,sBAAsB,CAACpC,MAAM,CAAC+C,GAAG;QAC5DW,0BAA0B,EAAEtB,sBAAsB,CAACpC,MAAM,CAACtD,IAAI;QAC9DiH,6BAA6B,EAAEvB,sBAAsB,CAACpC,MAAM,CAACkD,OAAO;QACpEU,8BAA8B,EAAExB,sBAAsB,CAACpC,MAAM,CAACoD,QAAQ;QACtES,iBAAiB,EAAEvB,OAAO,CAACwB,QAAQ,CAAC9D,MAAM,CAACc,EAAE;QAC7CiD,kBAAkB,EAAEzB,OAAO,CAACwB,QAAQ,CAAC9D,MAAM,CAAC+C,GAAG;QAC/CiB,6BAA6B,EAAE1B,OAAO,CAACwB,QAAQ,CAAC9D,MAAM,CAACiE,cAAc;QACrEC,kBAAkB,EAAE5B,OAAO,CAAC6B,cAAc,CAACnE,MAAM,CAACc,EAAE;QACpDsD,YAAY,EAAE5B,QAAQ,CAACxC,MAAM,CAACtD,IAAI;QAClC2H,WAAW,EAAE7B,QAAQ,CAACxC,MAAM,CAAC+C;MACjC,CAAC,CAAC;;MAEF;MACA,MAAM5G,oBAAoB,CAAC,MAAM,CAAC;MAElC,OAAO;QACH8F,aAAa;QACbE,gBAAgB;QAChB1B,GAAG;QACH,GAAG6B,OAAO;QACVI,iBAAiB;QACjBF,QAAQ;QACRvD;MACJ,CAAC;IACL;EACJ,CAAC,CAAC;EAEF,MAAMpC,GAAG,GAAGlB,mBAAmB,CAACc,OAAO,EAAE6H,SAAS,IAAI;IAClD,MAAMC,WAAW,GAAG9H,OAAO,CAACkC,SAAS,CAACsD,aAAa;IAEnD,MAAMuC,KAAsB,GAAG;MAC3BC,SAAS,EAAEF,WAAW,CAACvE,MAAM,CAACtD,IAAI;MAClCwG,OAAO,EAAEqB,WAAW,CAACvE,MAAM,CAACkD,OAAO;MACnCE,QAAQ,EAAEmB,WAAW,CAACvE,MAAM,CAACoD;IACjC,CAAC;IAEDkB,SAAS,CAACI,OAAO,CAACC,QAAQ,IAAI/I,2BAA2B,CAACa,OAAO,EAAE+H,KAAK,EAAEG,QAAQ,CAAC,CAAC;EACxF,CAAC,CAAC;EAEF9H,GAAG,CAACyB,UAAU,CAAC,MAAM;IACjBzB,GAAG,CAAC+H,kBAAkB,CAAC;MACnBlI,IAAI,EAAE,MAAM;MACZiI,QAAQ,EAAE;QACNnC,QAAQ,EAAE;UACNO,GAAG,EAAEtG,OAAO,CAACkC,SAAS,CAAC6D,QAAQ,CAACxC,MAAM,CAAC+C,GAAG;UAC1CrG,IAAI,EAAED,OAAO,CAACkC,SAAS,CAAC6D,QAAQ,CAACxC,MAAM,CAACtD;QAC5C,CAAC;QACDmI,aAAa,EAAE;UACX9B,GAAG,EAAEtG,OAAO,CAACkC,SAAS,CAACsD,aAAa,CAACjC,MAAM,CAAC+C,GAAG;UAC/CrG,IAAI,EAAED,OAAO,CAACkC,SAAS,CAACsD,aAAa,CAACjC,MAAM,CAACtD,IAAI;UACjDwG,OAAO,EAAEzG,OAAO,CAACkC,SAAS,CAACsD,aAAa,CAACjC,MAAM,CAACkD,OAAO;UACvDE,QAAQ,EAAE3G,OAAO,CAACkC,SAAS,CAACsD,aAAa,CAACjC,MAAM,CAACoD;QACrD;MACJ;IACJ,CAAC,CAAC;EACN,CAAC,CAAC;EAEF,OAAOvG,GAAG;AACd","ignoreList":[]}

package/pulumi/apps/core/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./CoreCognito.js";
+export * from "./CoreDynamo.js";
+export * from "./CoreEventBus.js";
+export * from "./CoreFileManager.js";
+export * from "./CoreVpc.js";
+export * from "./cognitoIdentityProviders/index.js";
+export * from "./createCorePulumiApp.js";
+export * from "./CoreAuditLogsDynamo.js";

package/pulumi/apps/core/index.js

@@ -0,0 +1,10 @@
+export * from "./CoreCognito.js";
+export * from "./CoreDynamo.js";
+export * from "./CoreEventBus.js";
+export * from "./CoreFileManager.js";
+export * from "./CoreVpc.js";
+export * from "./cognitoIdentityProviders/index.js";
+export * from "./createCorePulumiApp.js";
+export * from "./CoreAuditLogsDynamo.js";
+
+//# sourceMappingURL=index.js.map

package/pulumi/apps/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./CoreCognito.js\";\nexport * from \"./CoreDynamo.js\";\nexport * from \"./CoreEventBus.js\";\nexport * from \"./CoreFileManager.js\";\nexport * from \"./CoreVpc.js\";\nexport * from \"./cognitoIdentityProviders/index.js\";\nexport * from \"./createCorePulumiApp.js\";\nexport * from \"./CoreAuditLogsDynamo.js\";\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","ignoreList":[]}